---
title: Blind Eagle AutoIt Loader Execution From User Directories
id: 8f3a2c1e-7b4d-4e9a-a1c5-3d6f8b2e9a01
status: experimental
description: Detects AutoIt-compiled loaders (S0129) used by APT-C-36/Blind Eagle executing scripts or payloads from user-writable directories, a hallmark of the GitHub-staged loader pipeline.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\AutoIt3.exe'
            - '\AutoIt3_x64.exe'
    selection_path:
        CommandLine|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Users\Public\'
    selection_script:
        CommandLine|endswith:
            - '.au3'
            - '.a3x'
    condition: selection_img and (selection_path or selection_script)
falsepositives:
    - Legitimate AutoIt administrative scripts deployed by IT (allowlist known script hashes and paths)
level: high
tags:
    - attack.execution
    - attack.t1059
date: 2026/08/31
---
title: AsyncRAT/XWorm Process Injection Into .NET Framework Utilities
id: 2b7e4d9c-1a5f-4c8b-b3d6-9e2f7a4c1b05
status: experimental
description: Detects hollowed or injected .NET utilities (RegAsm, RegSvcs, MSBuild) making outbound network connections without a parent, consistent with AsyncRAT, DcRat, and XWorm payload injection used in Blind Eagle campaigns.
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\RegAsm.exe'
            - '\RegSvcs.exe'
            - '\MSBuild.exe'
            - '\InstallUtil.exe'
    filter_signed_parent:
        Initiated: 'true'
    condition: selection and filter_signed_parent
falsepositives:
    - Legitimate .NET compilation in developer environments (scope to non-developer endpoints)
level: critical
tags:
    - attack.defense_evasion
    - attack.t1055
    - attack.command_and_control
    - attack.t1071
date: 2026/08/31
---
title: Blind Eagle RAT Persistence Via Registry Run Key
id: 5c9d1f3a-8e2b-4f7c-c4a8-6b1d3e5f9a07
status: experimental
description: Detects registry Run key persistence entries pointing to user-writable or temp paths, matching AsyncRAT, Remcos, DcRat, and XWorm persistence observed in APT-C-36 intrusions.
author: Security Arsenal Threat Intel
logsource:
    category: registry_set
    product: windows
detection:
    selection_key:
        TargetObject|contains:
            - '\CurrentVersion\Run'
            - '\CurrentVersion\RunOnce'
    selection_value:
        Details|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Users\Public\'
            - '.ps1'
            - '.vbs'
    condition: selection_key and selection_value
falsepositives:
    - Software updaters storing binaries in AppData (allowlist by publisher and hash)
level: high
tags:
    - attack.persistence
    - attack.t1060
    - attack.t1547.001
date: 2026/08/31

// Blind Eagle / APT-C-36 campaign hunt: C2, lure domains, and RAT injection behavior
let CampaignIOCs = dynamic([
  "64.89.160.17",
  "dccomicrat81.duckdns.org",
  "creainovada.xyz",
  "consultanotificacionesjuridicas.site",
  "simpmit.co",
  "data-encoder.com",
  "config.data"
]);
let LureURL = "creainovada.xyz/instructions/";
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in~ (CampaignIOCs)
   or RemoteUrl has_any (CampaignIOCs)
   or RemoteUrl contains LureURL
   or RemoteUrl endswith ".duckdns.org"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          RemoteIP, RemoteUrl, RemotePort;
let InjectionBehavior = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("RegAsm.exe","RegSvcs.exe","MSBuild.exe","InstallUtil.exe","AutoIt3.exe")
| where isnotempty(RemoteIP) and RemoteIP !startswith "10." and RemoteIP !startswith "192.168."
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, RemoteIP, RemoteUrl;
union NetHits, InjectionBehavior
| sort by TimeGenerated desc

# Blind Eagle RAT hunt script: persistence, C2 connections, and staging artifacts
# Run elevated on suspected endpoints or via your EDR/Intune script deployment.

$Indicators = @(
    'dccomicrat81.duckdns.org','creainovada.xyz','data-encoder.com',
    'consultanotificacionesjuridicas.site','simpmit.co','64.89.160.17','config.data'
)

Write-Host "`n=== [1] Registry Run-Key Persistence Check ===" -ForegroundColor Cyan
$runPaths = @(
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($path in $runPaths) {
    if (Test-Path $path) {
        Get-ItemProperty $path | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Value -match 'AppData|Temp|Public|\.au3|\.a3x|AutoIt' -and
                $_.Name -notmatch '^PS'
            } | ForEach-Object {
                Write-Host "[!] Suspicious Run key: $($_.Name) = $($_.Value)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "`n=== [2] Active Connections to Campaign C2 ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $ip = $_.RemoteAddress
    if ($Indicators -contains $ip) {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[!] C2 connection: $ip`:$($_.RemotePort) via $($proc.ProcessName) (PID $($_.OwningProcess))" -ForegroundColor Red
    }
    try {
        $dns = (Resolve-DnsName $ip -ErrorAction Stop).NameHost
        if ($dns -match 'duckdns\.org') {
            Write-Host "[!] DuckDNS C2 resolved: $dns ($ip)" -ForegroundColor Red
        }
    } catch {}
}

Write-Host "`n=== [3] DNS Cache for IOC Domains ===" -ForegroundColor Cyan
Get-DnsClientCache | Where-Object {
    $name = $_.Entry
    $Indicators | Where-Object { $name -like "*$_*" }
} | Format-Table Entry, Data, TimeToLive -AutoSize

Write-Host "`n=== [4] Scheduled Tasks Launching From User Directories ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'AppData|Temp|AutoIt' -or
    ($_.Actions.Arguments -match 'AppData|Temp|\.au3|\.a3x')
} | ForEach-Object {
    Write-Host "[!] Suspicious task: $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" -ForegroundColor Red
}

Write-Host "`n=== [5] AutoIt / .NET Injection Utility Artifacts ===" -ForegroundColor Cyan
$stagingDirs = @("$env:APPDATA","$env:LOCALAPPDATA\Temp","C:\Users\Public")
foreach ($dir in $stagingDirs) {
    Get-ChildItem $dir -Recurse -Include *.a3x,*.au3,AutoIt3*.exe -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-45) } |
        ForEach-Object { Write-Host "[!] Staged AutoIt artifact: $($_.FullName) ($($_.LastWriteTime))" -ForegroundColor Red }
}
Write-Host "`n=== Hunt complete. Escalate any [!] findings to IR immediately. ===" -ForegroundColor Cyan